EP4107919A1 - Malware propagation forecasting - Google Patents

Malware propagation forecasting

Info

Publication number
EP4107919A1
EP4107919A1 EP21704579.8A EP21704579A EP4107919A1 EP 4107919 A1 EP4107919 A1 EP 4107919A1 EP 21704579 A EP21704579 A EP 21704579A EP 4107919 A1 EP4107919 A1 EP 4107919A1
Authority
EP
European Patent Office
Prior art keywords
computer systems
malware
computer
interacting
interaction
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP21704579.8A
Other languages
German (de)
French (fr)
Other versions
EP4107919B1 (en
Inventor
Xiao-si WANG
Jessica WELDING
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
British Telecommunications PLC
Original Assignee
British Telecommunications PLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by British Telecommunications PLC filed Critical British Telecommunications PLC
Publication of EP4107919A1 publication Critical patent/EP4107919A1/en
Application granted granted Critical
Publication of EP4107919B1 publication Critical patent/EP4107919B1/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the number of interactions per time period between an interacting pair of computer systems is determined based on a statistical distribution such as a Poisson or uniform distribution.
  • the number of interactions per time period between an interacting pair of computer systems in the set is defined based on historical records of interactions between the interacting pair of computer systems.
  • FIG. 1 is a block diagram of a computer system suitable for the operation of embodiments of the present invention.
  • a central processor unit (CPU) 102 is communicatively connected to a storage 104 and an input/output (I/O) interface 106 via a data bus 108.
  • the storage 104 can be any read/write storage device such as a random- access memory (RAM) or a non-volatile storage device.
  • RAM random- access memory
  • An example of a non-volatile storage device includes a disk or tape storage device.
  • the I/O interface 106 is an interface to devices for the input or output of data, or for both input and output of data. Examples of I/O devices connectable to I/O interface 106 include a keyboard, a mouse, a display (such as a monitor) and a network connection.
  • embodiments of the present invention employ a model of a set of computer systems in which interacting pairs of computer systems are identified, such interactions being based on previous communication occurring between the computer systems in the pair.
  • a model disregards intermediates in an interaction - such as physical resources or other computer systems involved in a communication.
  • an interaction arising from a social media communication between two users using each of a pair of computer systems will involve potentially multiple physical or logical networks, intermediate servers, service provider hosts, intermediate communication appliances and the like.
  • a model of the physical communication becomes burdened by the intermediate features of a typical inter-computer communication.
  • embodiments of the present invention address the endpoints of an interaction such as the computer systems through which users communicate.
  • a similar analysis can be conducted for interactions involving email, electronic messaging, file sharing and the like.
  • Figure 2 is a component diagram of an arrangement for malware protection for at least a subset of a set of computer systems according to an embodiment of the present invention.
  • a model 200 is provided as one or more data structures representing a set of computer systems and interactions therebetween.
  • the model is provided as a graph or similar data structure including nodes or vertices 210, each corresponding to a computer system, and edges 212 each connecting a pair of nodes 210 and representing interaction between computer systems corresponding to each node in the pair.
  • an edge 212 represents interaction between a pair of computer systems.
  • model 200 is illustrated as a literal graph in the arrangement of Figure 2, alternative data structures and logical representations of vertices and edges can be used, such as representations employing, for example, inter alia, vectors, arrays of vectors, matrices, compressed data structures and the like.
  • a protector component 208 is operable to deploy malware protection measures intended to inhibit a propagation of the malware through the set of computer systems.
  • the protector component 208 is a hardware, software, firmware or combination component arranged to access output from the simulator 202 such as one or more models, data structure representations, images, animations, visually renderable indications or other suitable representations of states of nodes corresponding to simulated states of computer systems in the set of computer systems.
  • Figure 4 is a component diagram of an arrangement for malware protection for at least a subset of a set of computer systems according to an embodiment of the present invention. Many of the elements of Figure 4 are identical to those described above with respect to Figure 2 and these will not be repeated here.
  • the arrangement of Figure 4 is operable during an infection, by a malware, of one or more computer systems in the set of computer systems and, accordingly, nodes 210 in the model 200 include indications of an infection state as, at least, susceptible or infected.
  • the arrangement of Figure 4 is operable during an infection such as in real-time while an infection is occurring in the set of computer systems.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Debugging And Monitoring (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

A computer implemented malware protection method to protect at least a subset of a set of computer systems from a malware, the method comprising: accessing a model of the set of computer systems, the model identifying interacting pairs of the computer systems in the set based on interactions corresponding to previous communication occurring between the computer systems in the pair; simulating, over a plurality of time periods, a propagation of the malware originating from a predetermined source computer system in the model, the simulation being based on a number of interactions per time period between each interacting pair of computer systems in the set, and a rate of transmission of the malware per interaction; responsive to the simulating step, identifying one or more computer systems or interacting pairs of computer systems for the deployment of a malware protection measure thereto so as to inhibit a propagation of the malware through the set of computer systems.

Description

Malware Propagation Forecasting
The present invention relates to the automatic forecasting of malware propagation across a set of computer systems.
Conventional malware protection mechanisms are reactive to the detection of malware in a network or the widespread distribution of anti-malware measures. Such approaches are known as "diagnosis and treatment". Similar techniques are used to combat the spread of biological infections. Mitigation measures such as anti-malware or malware-specific protective measures may not be known for some time after an infection has been studied for its effects. Further, the deployment of mitigation measures to an entire population of susceptible hosts in short order can be impractical.
Accordingly, it is beneficial to provide improvements to the deployment of protections for malware for sets of computer systems.
According to a first aspect of the present invention, there is provided a computer implemented malware protection method to protect at least a subset of a set of computer systems from a malware, the method comprising: accessing a model of the set of computer systems, the model identifying interacting pairs of the computer systems in the set based on interactions corresponding to previous communication occurring between the computer systems in the pair; simulating, over a plurality of time periods, a propagation of the malware originating from a predetermined source computer system in the model, the simulation being based on a number of interactions per time period between each interacting pair of computer systems in the set, and a rate of transmission of the malware per interaction; responsive to the simulating step, identifying one or more computer systems or interacting pairs of computer systems for the deployment of a malware protection measure thereto so as to inhibit a propagation of the malware through the set of computer systems. Preferably, identifying one or more computer systems or interacting pairs of computer systems includes identifying a computer system or interacting pair through which the malware propagates to a subset of other computer systems in the set.
Preferably, identifying one or more computer systems or interacting pairs of computer systems includes identifying a subset of the set of computer systems having a greatest proportion of computer systems infected by the malware.
Preferably, malware protection measures include one or more of: an anti-malware facility; a malware filter; a malware detector; a block, preclusion or cessation of interaction; and a reconfiguration of one or more computer systems. Preferably, the simulating step is performed a plurality of times for the source computer system and the responsive to the simulating step is responsive to the plurality of simulating steps.
Preferably, the simulating step is performed a plurality of times for each of multiple different source computer systems, and the responsive to the simulating step is responsive to the plurality of simulating steps.
Preferably, the number of interactions per time period between an interacting pair of computer systems is determined based on a statistical distribution such as a Poisson or uniform distribution. Preferably, the number of interactions per time period between an interacting pair of computer systems in the set is defined based on historical records of interactions between the interacting pair of computer systems.
Preferably, the model further identifies a class of interaction between interacting pairs of computer systems, the class of interaction being determined based on historical records of interactions between each computer system in an interacting pair, and wherein the rate of transmission of the malware per interaction is determined for each interacting pair of computer systems based on the class of interaction for the interacting pair.
According to a second aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.
According to a third aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.
Embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:
Figure 1 is a block diagram a computer system suitable for the operation of embodiments of the present invention;
Figure 2 is a component diagram of an arrangement for malware protection for at least a subset of a set of computer systems according to an embodiment of the present invention;
Figure 3 is a flowchart of a malware protection method according to an embodiment of the present invention; Figure 4 is a component diagram of an arrangement for malware protection for at least a subset of a set of computer systems according to an embodiment of the present invention; and
Figure 5 is a flowchart of a malware protection method according to an embodiment of the present invention.
Figure 1 is a block diagram of a computer system suitable for the operation of embodiments of the present invention. A central processor unit (CPU) 102 is communicatively connected to a storage 104 and an input/output (I/O) interface 106 via a data bus 108. The storage 104 can be any read/write storage device such as a random- access memory (RAM) or a non-volatile storage device. An example of a non-volatile storage device includes a disk or tape storage device. The I/O interface 106 is an interface to devices for the input or output of data, or for both input and output of data. Examples of I/O devices connectable to I/O interface 106 include a keyboard, a mouse, a display (such as a monitor) and a network connection. Malicious software, also known as computer contaminants or malware, is software that is intended to do direct or indirect harm in relation to one or more computer systems. Such harm can manifest as the disruption or prevention of the operation of all or part of a computer system, accessing private, sensitive, secure and/or secret data, software and/or resources of computing facilities, or the performance of illicit, illegal or fraudulent acts. Malware includes, inter alia, computer viruses, worms, botnets, trojans, spyware, adware, rootkits, keyloggers, dialers, malicious browser extensions or plugins and rogue security software.
Malware proliferation can occur in a number of ways. Malware can be communicated as part of an email such as an attachment or embedding. Alternatively, malware can be disguised as, or embedded, appended or otherwise communicated with or within, genuine software. Some malware is able to propagate via storage devices such as removable, mobile or portable storage including memory cards, disk drives, memory sticks and the like, or via shared or network attached storage. Malware can also be communicated over computer network connections such as the internet via websites or other network facilities or resources. Malware can propagate by exploiting vulnerabilities in computer systems such as vulnerabilities in software or hardware components including software applications, browsers, operating systems, device drivers or networking, interface or storage hardware.
A vulnerability is a weakness in a computer system, such as a computer, operating system, network of connected computers or one or more software components such as applications. Such weaknesses can manifest as defects, errors or bugs in software code that present an exploitable security weakness. An example of such a weakness is a buffer- overrun vulnerability, in which, in one form, an interface designed to store data in an area of memory allows a caller to supply more data than will fit in the area of memory. The extra data can overwrite executable code stored in the memory and thus such a weakness can permit the storage of malicious executable code within an executable area of memory. An example of such malicious executable code is known as ‘shellcode’ which can be used to exploit a vulnerability by, for example, the execution, installation and/or reconfiguration of resources in a computer system. Such weaknesses, once exploited, can bootstrap a process of greater exploitation of a target system, and propagation of the malware to other computer systems. The effects of malware on the operation and/or security of a computer system lead to a need to identify malware in a computer system in order to implement protective and/or remedial measures. While malware detection is often directed to computer systems themselves or the networks over which they communicate, embodiments of the present invention recognise that interactions between computer systems transcend the physical interconnections therebetween. In particular, embodiments of the present invention are directed to addressing interactions between computer systems that arise from communication between pairs of computer systems. Such interactions can include, for example, interactions between users of each of a pair of computer systems using, inter alia, social media, messaging, electronic mail or file sharing facilities. Thus, embodiments of the present invention employ a model of a set of computer systems in which interacting pairs of computer systems are identified, such interactions being based on previous communication occurring between the computer systems in the pair. Notably, such a model disregards intermediates in an interaction - such as physical resources or other computer systems involved in a communication. For example, an interaction arising from a social media communication between two users using each of a pair of computer systems will involve potentially multiple physical or logical networks, intermediate servers, service provider hosts, intermediate communication appliances and the like. Thus, a model of the physical communication becomes burdened by the intermediate features of a typical inter-computer communication. In contrast, embodiments of the present invention address the endpoints of an interaction such as the computer systems through which users communicate. A similar analysis can be conducted for interactions involving email, electronic messaging, file sharing and the like.
Embodiments of the present invention are directed to the deployment of malware protection measures so as to inhibit a propagation of a malware through a set of computer systems. Most preferably, the deployment of malware protection measures is targeted to provide an effective and/or efficient inhibition of the propagation. The nature and type of malware protection measures themselves are understood by those skilled in the art and can include, inter alia: anti-malware facilities; malware filters; malware detectors; a block, preclusion or cessation of interaction and/or communication, such as between computer systems; and/or a reconfiguration of one or more computer systems or communications facilities therebetween.
Embodiments of the present invention identify computer systems or interacting pairs of computer systems for the deployment of malware protection measures based on a simulation of a propagation of malware through the model of a set of computer systems. Such simulation employs simulation parameters including: a rate of interaction between each interacting pair of computer systems (i.e. a number of interactions per time period); and a rate of transmission of the malware between interacting computer per interaction. In some embodiments, some or all of these parameters are derived statistically according to a statistical distribution. In some embodiments, some or all of these parameters are determined based on historical interaction information over a historical time period. In some embodiments, some or all of these parameters are determined based on one or more machine learning processes based on historical interaction information.
Figure 2 is a component diagram of an arrangement for malware protection for at least a subset of a set of computer systems according to an embodiment of the present invention. A model 200 is provided as one or more data structures representing a set of computer systems and interactions therebetween. Preferably, the model is provided as a graph or similar data structure including nodes or vertices 210, each corresponding to a computer system, and edges 212 each connecting a pair of nodes 210 and representing interaction between computer systems corresponding to each node in the pair. Thus, an edge 212 represents interaction between a pair of computer systems. Each node 210 can have associated information for a corresponding computer system including, for example, inter alia: an identifier of the computer system; an identification of an organisational affiliation of the computer system; an identifier of a subnet to which the computer system is connected; and other information as will be apparent to those skilled in the art.
Preferably, an edge 212 constitutes an indication that at least one interaction has taken place over at least a predetermined historic time period between computer systems in a pair. Preferably, the existence of an edge 212 is not determinative, indicative or reflective of a degree, frequency or propensity of interaction between computer systems in a pair - rather, the edge 212 identifies that interaction has taken place. In some embodiments, edges 212 can have associated, for example, inter alia: an edge identifier; an identification of a pair of nodes (and/or the corresponding computer systems) that the edge interconnects; and/or interaction frequency information between a pair of computer systems. It will be appreciated by those skilled in the art that, while the model 200 is illustrated as a literal graph in the arrangement of Figure 2, alternative data structures and logical representations of vertices and edges can be used, such as representations employing, for example, inter alia, vectors, arrays of vectors, matrices, compressed data structures and the like.
The arrangement of figure 2 includes a simulator 202 as a hardware, software, firmware or combination component arranged to perform a simulation of a propagation of a malware in the set of computer systems represented by the model 200. The simulator 202 is operable on the basis of simulation parameters including: an interaction rate 204 as a number of interactions between pairs of interacting computer systems in a time period; and a transmission rate 206 as a rate of transmission of a malware between computer systems in a pair of systems per interaction. Preferably, the transmission rate 206 is a probability of transmission of a malware from one node to another node during an interaction between the nodes. Preferably, the transmission rate 206 incorporates aspects of a malware infection process. For example, in the case of malware transmitted as a web-link between two computer systems by email, the transmission rate can reflect all of: a probability that an email is communicated between the two computer systems; a probability that the email includes the malicious web-link; and a probability that a recipient accesses the malicious web-link resulting in malware infection. In one embodiment, the interactions rate 204 is sampled from one or more statistical distributions 214 to model different types of interaction. For example, a Poisson or uniform distribution can be used to model a number of interactions between a pair of computer systems over a time period, such as a number of emails communicated over the time period. In one embodiment, the transmission rate 206 is initialised in advance, such as by a predetermined value. For example, a transmission rate 206 having a value of 0.0001 is indicative of a probability that a first computer system in an interacting pair of computer systems transmits a malware to a second computer system in the pair within a single predetermined time period is 0.0001. In one embodiment, the interaction rate 204 between each of an interacting pair of computer systems in the set of computer systems is defined based on historical records of interactions between the computer systems.
The simulator 202 can operate on the basis of configurable characteristics such as simulation assumptions. For example, the simulator 202 may operate on the basis that any computer system as represented by a node in the model 200 can only transmit the malware to first-degree neighbours according to the model 200. Further, the simulator 202 preferably operates on the basis that each computer system has a state of infection at a point in time. States of infection at a point in time can include, for example: a state of susceptibility in which a computer system is susceptible to infection, such as a computer system that is not and has not been so far infected and is not specifically protected from infection by a particular malware; a state of infected in which a computer system is subject to infection by the malware at the point in time; and a state of removed or remediated in which a computer system is remediated of a past infection or protected from prospective infection by the malware. It will be appreciated by those skilled in the art that sub-states of these states can also be employed, such as, inter alia: an infected state that is not infectious (i.e. transmission of malware cannot be effected by a computer system in such a state); an infected state that is infectious; an infected state that is detected; and an infected state that is not detected (such as might be determined by the simulator 202).
Thus, in use, the simulator 202 is operable for a time period to model the propagation of a malware infection. In one embodiment, one or more predetermined source computer systems represented in the model 200 are selected as originating computer systems for the malware infection such that propagation is simulated from such originating computer systems. Preferably, the simulator 202 is executed for each of a plurality of time periods so as to model the propagation of the malware in the set of computer systems over time. Additionally or alternatively, the simulator 202 can be performed a plurality of times for each of a plurality of predetermined source computer systems selected as originating computer systems for the malware infection.
According to one embodiment, where the transmission rate 206 is denoted as p, and the interaction rate 204 is denoted as c, the simulator 202 can model propagation of a malware by formulating an infection probability of a susceptible computer system indicated as node / by its infected neighbours:
Considering nodei where i e (1, ... , n] where n = number of nodes in the model, Thus, an exemplary model for the simulator 202 to model transitions of nodes 210 from a state of susceptible to infected and from infected to removed (i.e. remediated) can be: where 0 is a rate of removal/remediation.
Responsive to the simulation by the simulator 202, and, in particular, responsive to the model of propagation of a malware determined by the simulator 202, a protector component 208 is operable to deploy malware protection measures intended to inhibit a propagation of the malware through the set of computer systems. The protector component 208 is a hardware, software, firmware or combination component arranged to access output from the simulator 202 such as one or more models, data structure representations, images, animations, visually renderable indications or other suitable representations of states of nodes corresponding to simulated states of computer systems in the set of computer systems. For example, a representation of states of computer systems can be provided based on the model 200 so as to indicate, for each computer system by way of a node in the model 200, a state of the computer system (such as susceptible, infected, removed) over each of a plurality of time periods for which the simulator 202 was executed.
The protector 208 identifies one or more computer systems or interacting pairs of computer systems (such as are represented by edges 212 in the model 200) for the deployment of malware protection measures. Such identified systems or pairs of systems can be selected based on, for example, inter alia: a computer system or interacting pair of systems through which malware propagates in the simulation to a subset of other computer systems in the set of computer systems; identifying a subset of computer systems having a relatively greater, or greatest, proportion of computer systems infected by the malware according to the simulation, so as to identify one or more computer systems or pairs of systems as a gateway, link or bridge to such identified subset; a number of computer systems to which the malware is propagated via a computer system or pair of systems; and other criteria as will be apparent to those skilled in the art. For example, in one embodiment, “choke-points” in the model 200 can be identified by the protector 208 based on the simulator 202 output as nodes or pairs of nodes representing computer systems or interacting pairs of systems constituting pathways for propagation of the malware to subsets of nodes in the model 200. The malware protection measures deployed by the protector 208 can include those previously described, and in this way at least a subset of the set of computer systems can be protected from the malware by the targeted deployment of malware protection measures.
In one embodiment of the present invention, the model 200 further identifies a class of interaction between interacting pairs of computer systems, such as an identification of a type of interaction that takes place between computer systems. For example, computer systems that typically interact by way of email can be classified differently to computer systems that typically interact by way of file-sharing, network drive sharing or the like. A class of interaction between computer systems can be determined based on historical records of interactions between each computer system in an interacting pair. In such embodiments, the rate of transmission 206 of the malware per interaction can be determined for each interacting pair of computer systems based on the class of interaction for the interacting pair so as to take account of the different types of interaction and a different propensity for malware propagation by each type.
Figure 3 is a flowchart of a malware protection method according to an embodiment of the present invention. Initially, at step 302, the method accesses a model of a set of computer systems identifying interacting pairs of the computer systems based on interactions corresponding to previous communication occurring between the computer systems in the pair. At step 304 the method commences an iteration between each of a plurality of time periods for simulation. At step 306, for each simulated time period, the method simulates a propagation of a malware originating from a predetermined source computer system in the model. The simulation is based on a number of interactions per time period 204 between each interacting pair of computer systems in the set, and a rate of transmission 206 of the malware per interaction. The method loops at step 308 through the time periods. Subsequently, at step 310 the method identifies one or more computer systems or interacting pairs of computer systems for the deployment of a malware protection measure to inhibit a propagation of the malware through the set of computer systems. Figure 4 is a component diagram of an arrangement for malware protection for at least a subset of a set of computer systems according to an embodiment of the present invention. Many of the elements of Figure 4 are identical to those described above with respect to Figure 2 and these will not be repeated here. The arrangement of Figure 4 is operable during an infection, by a malware, of one or more computer systems in the set of computer systems and, accordingly, nodes 210 in the model 200 include indications of an infection state as, at least, susceptible or infected. Thus, the arrangement of Figure 4 is operable during an infection such as in real-time while an infection is occurring in the set of computer systems.
According to the arrangement of Figure 4, the transmission rate 404 is determined based on a set of temporal historical interaction data 406. The temporal historical interaction data 406 identifies interactions 408 between pairs of computer systems represented in the model 200 during each of a plurality of historical time periods - the time period being historical in that they occur prior to the operation of the simulator 202. A transmission rate estimator 402 is provided as a hardware, software, firmware or combination component for estimating a transmission rate 404 for input to the simulator 202 based on the temporal historical interaction data 406. In one embodiment, the transmission rate estimator 402 is operable to determine the rate of transmission 404 by modelling probabilities of transmission of the malware between interacting pairs of computer systems identified in the temporal historical interaction data.
Preferably, the transmission rate estimator 402 determines a maximum likelihood function for interactions occurring in each of a plurality of time periods for the historical interaction data 406 to determine an average probability of transmission of the malware between interacting pairs of computer systems. Additionally or alternatively, the probabilities of transmission can be modelled using a suitable statistical modelling function such as a Markov Chain Monte Carlo method for approximation of a probability as will be understood by those skilled in the art.
Accordingly, embodiments according to Figure 4 employ interaction data 408 indicating actual frequencies of interactions between computer systems represented in the model 200. Such interaction data is preferably directed such that, for a computer system (node in the model 200), only incoming edges (along which interactions are received) are considered prospective transmitters of malware. The interaction data 408 is temporal in that it is broken down into time periods in order that historic malware infection propagation can be modelled on a suitable time-based granularity (such as by minute, hour, day). In one embodiment, a number of interactions with a susceptible target (i.e. endpoint of an interaction) computer system from only infected source (i.e. originating) computer system are identified in the interaction data 408. By way of rationalising interaction data 408, interactions between interacting pairs of computer systems can be represented as a summary or summation of total incoming interactions from infected neighbours per time period for input to the transmission rate estimator 402.
In one embodiment, the transmission rate estimator 402 determines a maximum likelihood function to estimate the transmission rate 404 according to a method such as: Input:time : T list of vector of interactions : c number of nodes : n list of binary vectors length n, containing 1 for infected, containing 0 for susceptible nodes :y Output: average infection transmission rate per interaction: p
For each time period in T: create vector of results
For each susceptible node: sum all interactions c from infected nodes input summed interactions, binary vector y to maximum likelihood function apply log transformation to the maximum likelihood function minimise the log transformed function append result of minimisation to vector of results return mean of vector of results
Figure 5 is a flowchart of a malware protection method according to an embodiment of the present invention. Many of the steps of Figure 5 are identical to those described above with respect to Figure 3 and these will not be repeated here. Additionally, Figure 5 includes step 503 according to which a rate of transmission of malware per interaction is estimated by the transmission rate estimator as described above.
Insofar as embodiments of the invention described are implementable, at least in part, using a software-controlled programmable processing device, such as a microprocessor, digital signal processor or other processing device, data processing apparatus or system, it will be appreciated that a computer program for configuring a programmable device, apparatus or system to implement the foregoing described methods is envisaged as an aspect of the present invention. The computer program may be embodied as source code or undergo compilation for implementation on a processing device, apparatus or system or may be embodied as object code, for example.
Suitably, the computer program is stored on a carrier medium in machine or device readable form, for example in solid-state memory, magnetic memory such as disk or tape, optically or magneto-optically readable memory such as compact disk or digital versatile disk etc., and the processing device utilises the program or a part thereof to configure it for operation. The computer program may be supplied from a remote source embodied in a communications medium such as an electronic signal, radio frequency carrier wave or optical carrier wave. Such carrier media are also envisaged as aspects of the present invention.
It will be understood by those skilled in the art that, although the present invention has been described in relation to the above described example embodiments, the invention is not limited thereto and that there are many possible variations and modifications which fall within the scope of the invention.
The scope of the present invention includes any novel features or combination of features disclosed herein. The applicant hereby gives notice that new claims may be formulated to such features or combination of features during prosecution of this application or of any such further applications derived therefrom. In particular, with reference to the appended claims, features from dependent claims may be combined with those of the independent claims and features from respective independent claims may be combined in any appropriate manner and not merely in the specific combinations enumerated in the claims.

Claims

1. A computer implemented malware protection method to protect at least a subset of a set of computer systems from a malware, the method comprising: accessing a model of the set of computer systems, the model identifying interacting pairs of the computer systems in the set based on interactions corresponding to previous communication occurring between the computer systems in the pair; simulating, over a plurality of time periods, a propagation of the malware originating from a predetermined source computer system in the model, the simulation being based on a number of interactions per time period between each interacting pair of computer systems in the set, and a rate of transmission of the malware per interaction; responsive to the simulating step, identifying one or more computer systems or interacting pairs of computer systems for the deployment of a malware protection measure thereto so as to inhibit a propagation of the malware through the set of computer systems.
2. The method of claim 1 wherein identifying one or more computer systems or interacting pairs of computer systems includes identifying a computer system or interacting pair through which the malware propagates to a subset of other computer systems in the set.
3. The method of any preceding claim wherein identifying one or more computer systems or interacting pairs of computer systems includes identifying a subset of the set of computer systems having a greatest proportion of computer systems infected by the malware.
4. The method of any preceding claim wherein malware protection measures include one or more of: an anti-malware facility; a malware filter; a malware detector; a block, preclusion or cessation of interaction; and a reconfiguration of one or more computer systems.
5. The method of any preceding claim wherein the simulating step is performed a plurality of times for the source computer system and the responsive to the simulating step is responsive to the plurality of simulating steps.
6. The method of any preceding claim wherein the simulating step is performed a plurality of times for each of multiple different source computer systems, and the responsive to the simulating step is responsive to the plurality of simulating steps.
7. The method of any preceding claim wherein the number of interactions per time period between an interacting pair of computer systems is determined based on a statistical distribution such as a Poisson or uniform distribution.
8. The method of any preceding claim wherein the number of interactions per time period between an interacting pair of computer systems in the set is defined based on historical records of interactions between the interacting pair of computer systems.
9. The method of any preceding claim wherein the model further identifies a class of interaction between interacting pairs of computer systems, the class of interaction being determined based on historical records of interactions between each computer system in an interacting pair, and wherein the rate of transmission of the malware per interaction is determined for each interacting pair of computer systems based on the class of interaction for the interacting pair.
10. A computer system including a processor and memory storing computer program code for performing the steps of the method of any preceding claim.
11. A computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer to perform the steps of a method as claimed in any of claims 1 to 9.
EP21704579.8A 2020-02-17 2021-02-16 Malware propagation forecasting Active EP4107919B1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP20157627 2020-02-17
PCT/EP2021/053764 WO2021165257A1 (en) 2020-02-17 2021-02-16 Malware propagation forecasting

Publications (2)

Publication Number Publication Date
EP4107919A1 true EP4107919A1 (en) 2022-12-28
EP4107919B1 EP4107919B1 (en) 2024-06-19

Family

ID=69631425

Family Applications (1)

Application Number Title Priority Date Filing Date
EP21704579.8A Active EP4107919B1 (en) 2020-02-17 2021-02-16 Malware propagation forecasting

Country Status (3)

Country Link
US (1) US12511386B2 (en)
EP (1) EP4107919B1 (en)
WO (1) WO2021165257A1 (en)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12511386B2 (en) 2020-02-17 2025-12-30 British Telecommunications Public Limited Company Malware propagation forecasting
US12526309B2 (en) 2020-02-17 2026-01-13 British Telecommunications Public Limited Company Real-time malware propagation forecasting
WO2021198295A1 (en) 2020-04-03 2021-10-07 British Telecommunications Public Limited Company Malware protection based on final infection size
GB2602628B (en) 2020-12-31 2023-03-29 British Telecomm Identifying Computer Systems for Malware Infection Mitigation
US11914709B2 (en) * 2021-07-20 2024-02-27 Bank Of America Corporation Hybrid machine learning and knowledge graph approach for estimating and mitigating the spread of malicious software
GB202203371D0 (en) * 2022-03-10 2022-04-27 British Telecomm Determining a reproduction number for a malware
GB202203355D0 (en) * 2022-03-10 2022-04-27 British Telecomm Simulation of malware with changing signatures
GB202203366D0 (en) 2022-03-10 2022-04-27 British Telecomm Time-based approaches in malware simulation for responsive measure deployment

Family Cites Families (76)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1147795C (en) 2001-04-29 2004-04-28 北京瑞星科技股份有限公司 Method, system and medium for detecting and clearing known and anknown computer virus
EP1280298A1 (en) 2001-07-26 2003-01-29 BRITISH TELECOMMUNICATIONS public limited company Method and apparatus of detecting network activity
US20030105973A1 (en) 2001-12-04 2003-06-05 Trend Micro Incorporated Virus epidemic outbreak command system and method using early warning monitors in a network environment
US8359650B2 (en) 2002-10-01 2013-01-22 Skybox Secutiry Inc. System, method and computer readable medium for evaluating potential attacks of worms
US9503470B2 (en) 2002-12-24 2016-11-22 Fred Herz Patents, LLC Distributed agent based model for security monitoring and response
US7287278B2 (en) 2003-08-29 2007-10-23 Trend Micro, Inc. Innoculation of computing devices against a selected computer virus
US7084760B2 (en) 2004-05-04 2006-08-01 International Business Machines Corporation System, method, and program product for managing an intrusion detection system
US8032937B2 (en) 2004-10-26 2011-10-04 The Mitre Corporation Method, apparatus, and computer program product for detecting computer worms in a network
US8516583B2 (en) 2005-03-31 2013-08-20 Microsoft Corporation Aggregating the knowledge base of computer systems to proactively protect a computer from malware
WO2006132987A1 (en) 2005-06-03 2006-12-14 Board Of Trustees Of Michigan State University Worm propagation modeling in a mobile ad-hoc network
JP2007249579A (en) 2006-03-15 2007-09-27 Fujitsu Ltd Worm countermeasure parameter determination program, worm countermeasure parameter determination apparatus, node number determination program, node number determination apparatus, and node number restriction system
US8117654B2 (en) 2006-06-30 2012-02-14 The Invention Science Fund I, Llc Implementation of malware countermeasures in a network device
US8667581B2 (en) * 2006-06-08 2014-03-04 Microsoft Corporation Resource indicator trap doors for detecting and stopping malware propagation
IL181428A0 (en) 2007-02-19 2007-07-04 Deutsche Telekom Ag Deployment of distributed network intrusion detection systems in social networks
IL183390A0 (en) 2007-05-24 2007-09-20 Deutsche Telekom Ag Distributed system for the detection
US20110078797A1 (en) 2008-07-29 2011-03-31 Novell, Inc. Endpoint security threat mitigation with virtual machine imaging
US10290053B2 (en) 2009-06-12 2019-05-14 Guardian Analytics, Inc. Fraud detection and analysis
RU91203U1 (en) 2009-10-01 2010-01-27 ЗАО "Лаборатория Касперского" SYSTEM FOR DETECTING AND CONSTRUCTING A FORECAST OF THE DEVELOPMENT OF THE EPIDEMIC COMPUTER VIRUSES
US9135018B2 (en) 2009-12-11 2015-09-15 Deutsche Telekom Ag Computer cluster and method for providing a disaster recovery functionality for a computer cluster
WO2011094312A1 (en) 2010-01-26 2011-08-04 Silver Tail Systems, Inc. System and method for network security including detection of man-in-the-browser attacks
US9215244B2 (en) 2010-11-18 2015-12-15 The Boeing Company Context aware network security monitoring for threat detection
US9154517B2 (en) 2012-06-19 2015-10-06 AO Kaspersky Lab System and method for preventing spread of malware in peer-to-peer network
US10084806B2 (en) 2012-08-31 2018-09-25 Damballa, Inc. Traffic simulation to identify malicious activity
US20200064444A1 (en) 2015-07-17 2020-02-27 Origin Wireless, Inc. Method, apparatus, and system for human identification based on human radio biometric information
US10742475B2 (en) 2012-12-05 2020-08-11 Origin Wireless, Inc. Method, apparatus, and system for object tracking sensing using broadcasting
US9225739B2 (en) 2013-06-26 2015-12-29 Microsoft Technology Licensing, Llc Providing user-specific malware assessment based on social interactions
US10298598B1 (en) 2013-12-16 2019-05-21 Amazon Technologies, Inc. Countering service enumeration through imposter-driven response
US9060018B1 (en) 2014-02-05 2015-06-16 Pivotal Software, Inc. Finding command and control center computers by communication link tracking
US9503467B2 (en) 2014-05-22 2016-11-22 Accenture Global Services Limited Network anomaly detection
US11397258B2 (en) 2015-07-17 2022-07-26 Origin Wireless, Inc. Method, apparatus, and system for outdoor target tracking
US12046040B2 (en) 2015-07-17 2024-07-23 Origin Research Wireless, Inc. Method, apparatus, and system for people counting and recognition based on rhythmic motion monitoring
CN104166708A (en) 2014-08-11 2014-11-26 肇庆学院 Mobile phone virus spreading modeling method based on social network and semi-Markov process
US9210185B1 (en) 2014-12-05 2015-12-08 Lookingglass Cyber Solutions, Inc. Cyber threat monitor and control apparatuses, methods and systems
US9679140B2 (en) 2014-12-27 2017-06-13 Mcafee, Inc. Outbreak pathology inference
US11500058B2 (en) 2015-07-17 2022-11-15 Origin Wireless, Inc. Method, apparatus, and system for wireless proximity sensing
US9699205B2 (en) 2015-08-31 2017-07-04 Splunk Inc. Network security system
GB2547202B (en) 2016-02-09 2022-04-20 Darktrace Ltd An anomaly alert system for cyber threat detection
US12235659B2 (en) 2016-02-29 2025-02-25 AI Incorporated Obstacle recognition method for autonomous robots
CN106027513B (en) 2016-05-15 2019-01-08 广东技术师范学院 Propagation characteristic analysis method of the computer virus under SDN mobile environment
US10372910B2 (en) 2016-06-20 2019-08-06 Jask Labs Inc. Method for predicting and characterizing cyber attacks
KR101825911B1 (en) 2016-09-26 2018-02-07 국방과학연구소 Worm attack modeling and simulation for data transport network having hierarchical structure
CN106656571A (en) 2016-11-09 2017-05-10 天津大学 Clustering wireless sensor network malicious program propagation model based on evolution game
US10380348B2 (en) 2016-11-21 2019-08-13 ZingBox, Inc. IoT device risk assessment
CN106599691B (en) 2016-12-23 2019-06-18 贾志娟 A kind of Computer Virus Spread based on complex network seeks source method
US10862917B2 (en) 2017-04-21 2020-12-08 Cisco Technology, Inc. Network resource implementation prioritization
CN106936855B (en) 2017-05-12 2020-01-10 中国人民解放军信息工程大学 Network security defense decision-making determination method and device based on attack and defense differential game
US10623432B2 (en) 2017-06-21 2020-04-14 International Business Machines Corporation Mitigating security risks utilizing continuous device image reload with data integrity
US10484410B2 (en) 2017-07-19 2019-11-19 Cisco Technology, Inc. Anomaly detection for micro-service communications
EP3643040A4 (en) 2017-08-08 2021-06-09 SentinelOne, Inc. METHODS, SYSTEMS AND DEVICES FOR DYNAMIC MODELING AND GROUPING OF END POINTS FOR ONBOARD NETWORKING
US11423143B1 (en) 2017-12-21 2022-08-23 Exabeam, Inc. Anomaly detection based on processes executed within a network
US11599688B2 (en) 2018-02-26 2023-03-07 Noblis, Inc. Multi-layer cyber-physical systems simulation platform
GB201804776D0 (en) 2018-03-25 2018-05-09 British Telecomm Malware Barrier
US11533333B2 (en) 2018-03-25 2022-12-20 British Telecommunications Public Limited Company Malware infection prediction
US11470109B2 (en) 2018-03-25 2022-10-11 British Telecommunications Public Limited Company Malware barrier
CN109190375B (en) 2018-08-02 2021-03-19 北京北信源信息安全技术有限公司 Equation set for analyzing malicious program propagation rules and malicious program diffusion prediction method
JP6970344B2 (en) 2018-08-03 2021-11-24 日本電信電話株式会社 Infection spread attack detection device, attack source identification method and program
JP7099533B2 (en) 2018-09-25 2022-07-12 日本電気株式会社 Impact range estimation device, impact range estimation method, and program
US11349857B1 (en) 2019-03-21 2022-05-31 Snap Inc. Suspicious group detection
US11190534B1 (en) 2019-03-21 2021-11-30 Snap Inc. Level of network suspicion detection
US11245716B2 (en) 2019-05-09 2022-02-08 International Business Machines Corporation Composing and applying security monitoring rules to a target environment
US11704431B2 (en) 2019-05-29 2023-07-18 Microsoft Technology Licensing, Llc Data security classification sampling and labeling
WO2021001237A1 (en) 2019-06-30 2021-01-07 British Telecommunications Public Limited Company Impeding location threat propagation in computer networks
US11316891B2 (en) 2019-07-18 2022-04-26 Bank Of America Corporation Automated real-time multi-dimensional cybersecurity threat modeling
US11829484B2 (en) 2019-11-04 2023-11-28 Monaco Risk Analytics Inc Cyber risk minimization through quantitative analysis of aggregate control efficacy
US11159557B2 (en) 2019-11-13 2021-10-26 Servicenow, Inc. Network security through linking vulnerability management and change management
CA3100468A1 (en) 2019-11-21 2021-05-21 Royal Bank Of Canada System and method for detecting phishing events
US12126650B2 (en) 2019-12-03 2024-10-22 Charter Communications Operating, Llc Detection and remediation of malicious network traffic using tarpitting
US10963802B1 (en) 2019-12-19 2021-03-30 Sas Institute Inc. Distributed decision variable tuning system for machine learning
US11283828B2 (en) 2020-01-17 2022-03-22 International Business Machines Corporation Cyber-attack vulnerability and propagation model
US11727109B2 (en) 2020-01-24 2023-08-15 International Business Machines Corporation Identifying adversarial attacks with advanced subset scanning
US12526309B2 (en) 2020-02-17 2026-01-13 British Telecommunications Public Limited Company Real-time malware propagation forecasting
US12511386B2 (en) 2020-02-17 2025-12-30 British Telecommunications Public Limited Company Malware propagation forecasting
WO2021198295A1 (en) 2020-04-03 2021-10-07 British Telecommunications Public Limited Company Malware protection based on final infection size
US11647034B2 (en) 2020-09-12 2023-05-09 Microsoft Technology Licensing, Llc Service access data enrichment for cybersecurity
GB2599375B (en) * 2020-09-29 2022-11-02 British Telecomm Malware infection mitigation of critical computer systems
US11973780B2 (en) * 2020-10-14 2024-04-30 Palo Alto Networks, Inc. Deobfuscating and decloaking web-based malware with abstract execution

Also Published As

Publication number Publication date
EP4107919B1 (en) 2024-06-19
US12511386B2 (en) 2025-12-30
WO2021165257A1 (en) 2021-08-26
US20230123046A1 (en) 2023-04-20

Similar Documents

Publication Publication Date Title
US12526309B2 (en) Real-time malware propagation forecasting
US12511386B2 (en) Malware propagation forecasting
EP4128694B1 (en) Malware protection based on final infection size
EP4222923B1 (en) Malware infection mitigation of critical computer systems
US12273376B2 (en) Identifying computer systems for malware infection mitigation
US12587559B2 (en) Time-based approaches in malware simulation for responsive measure deployment
EP3172692A1 (en) Remedial action for release of threat data
IL311808A (en) Method for analyzing the vulnerability of an information system to a cyber attack
US20210194915A1 (en) Identification of potential network vulnerability and security responses in light of real-time network risk assessment
US20250209181A1 (en) Determining a reproduction number for a malware
Kondakci Epidemic state analysis of computers under malware attacks
US20250202923A1 (en) Contact rates in malware simulation for responsive measure deployment
EP4490637A1 (en) Simulation of malware with changing signatures
US20250209170A1 (en) Method and system for detecting volumetric attacks using multi-phase analysis of application programming interface calls
GB2592067A (en) Real-time malware propagation forecasting
US10230744B1 (en) Detecting periodic behavior in a communication session using clustering
CN105871834B (en) A method and device for calculating malicious index
GB2593780A (en) Malware protection based on final infection size
US12619740B2 (en) Simulation of malware with changing signatures
WO2025004174A1 (en) Attack analysis device, attack analysis method, and attack analysis program

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20220706

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230623

REG Reference to a national code

Ref country code: DE

Ipc: G06F0021560000

Ref country code: DE

Ref legal event code: R079

Ref document number: 602021014567

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: G06F0021560000

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 9/40 20220101ALI20231225BHEP

Ipc: G06F 21/56 20130101AFI20231225BHEP

INTG Intention to grant announced

Effective date: 20240131

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602021014567

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240920

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240919

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240920

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240919

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1696380

Country of ref document: AT

Kind code of ref document: T

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241021

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241021

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241019

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241019

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602021014567

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20250320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240619

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20250216

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20250228

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20250228

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20250228

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20250216

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20260121

Year of fee payment: 6

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20260121

Year of fee payment: 6

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20260121

Year of fee payment: 6